![]() ![]() The reason I’ve never pursued this isn’t due to security but the technical problem of actually getting it into browsers so when you go login at a net cafe the tech is available.Īnother method I’ve used to store passwords is to print them out as barcodes, and use a barcode reader to enter them. I’m not a security expert though so perhaps there are other problems. This has the advantage that the user can work from any location without having to bring their encrypted password file with them, and several disadvantages–if you want to change the password to one site only, you now have to remember which passphrase you used with which site (it returns use to different passwords per site) people don’t need access to your password file to get all your passwords if they get your passphrase if a site changes its domain name there are issues (although I assume this is no different than SSL certificates?). One idea I’ve been tossing around for many years is to have the user have a single passphrase for all sites and have the browser (or whatever) hash the passphrase and the domain name together to create the actual password. So far, I have been carrying a Live CD like Knoppix with me for this purpose, but I like the idea of security in your pocket which is rather painful in the case of CDs… I’m thinking about installing a small graphical Linux installation on a 2.2GB USB stick in addition to the existence of my encrypted loopback file so that I can boot into a trusted system on foreign hardware and mount my file on a trusted system whenever needed. The file houses passwords, my SSH keys, GnuPG keys and other information I’m not keen on sharing with a wider audience. ![]() I have a backup of the file on my workstation at home. If I lose this stick I can be pretty confident, that nobody will be able to read the contents. It houses an encrypted file that I can mount as a loopback device using any Linux system with dmcrypt. I have a small USB stick I carry with me. You’ll never know it! In the age of digital photography (almost every mobile phone carries a digital camera today) it takes only seconds to make a copy of a piece of paper. Someone could open it, peak at your passwords and put them back in. ![]() Control yourself and make a mental note whenever you notice your wallet has been accessable for somebody for as much time as necessary to peak the insides. Imagine you leave your wallet out of sight for just a half a minute. IMHO it’s not a good idea to keep carrying passwords on a piece of paper with you. And I definetely don’t carry valuable information in my wallet. I even make copies of documents instead of carrying the originals where this is possible. I never carry large amounts of money in it. I only keep things in my wallet that I can afford to lose. Take myself for example, I am a rather paranoid person. It is probably more likely that your wallet gets stolen than you get cheated on Ebay. Why is Bruce claiming that putting a piece of paper with all your passwords in your wallet is a good idea(tm)? The thought lets the hairs on my neck and arms stand upright in utter shock! □ Wallets get stolen every day. Tags: cryptography, encryption, open source, passwords, Schneier news, web It is the same as this, for the PocketPC. (I should have picked a more obscure name for the program.) Note that my Password Safe is not the same as this, this, this, or this PasswordSafe. Thank you to him and to all the other programmers who worked on the project. Security through simplicity.Ĭurrently, Password Safe is an open source project at SourceForge, and is run by Rony Shapiro. The program is easy to use, and isn’t bogged down by lots of unnecessary features. It’s a small program that encrypts all of your passwords using one passphrase. I designed Password Safe as another solution. ![]() I have long advocated writing them all down on a piece of paper and putting it in your wallet. These days, anyone who is on the Web regularly needs too many passwords, and it’s impossible to remember them all. Password Safe is a free Windows password-storage utility. ![]()
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |